Examkin

Soru

Zorluk: KolayShared Access Signatures and Token-based Storage Security

You are developing a web application that retrieves reports from Azure Blob Storage. You need to generate a Service Shared Access Signature (SAS) token to allow an external partner to download a specific report file. To meet security guidelines, you must restrict access to a specific client IP address and enforce the use of HTTPS. Which two configurations must you define in the SAS token to meet these requirements? (Select TWO.)

  1. An IP address filter restricting access to the partner's public IP addressCevap
  2. An HTTPS-only protocol restrictionCevap
  3. C
    Full write and delete permissions on the entire storage container
  4. D
    The storage account's root credentials embedded directly within the SAS payload

Cevap

The correct options are the IP address filter restricting access to the partner's public IP address, and the HTTPS-only protocol restriction.
The correct configurations are the IP address filter and the HTTPS-only protocol restriction. An IP address filter limits the client source IP, and the protocol parameter ensures secure transit over HTTPS.

Adım Adım Çözüm

1
Analyze the security requirements specified in the scenario.
The requirements are: download a specific report file (Read access), restrict access to a specific client IP address, and enforce HTTPS.
This establishes the constraints needed to select the correct configurations.
2
Determine the SAS configurations that implement IP filtering and protocol enforcement.
Defining the allowed IP address or range limits source access, and setting the protocol parameter to HTTPS only secures transit.
These parameters directly correspond to standard Azure Storage SAS token properties.
3
Evaluate the incorrect options against security best practices.
Granting full container-level write/delete permissions violates least-privilege, and embedding root credentials compromises account security.
This rules out the distractors.

Anahtar Kavram

Configuring security constraints on Azure Storage Shared Access Signatures (SAS) to enforce least privilege, specific IP access, and secure protocols.
Bu soruyu puanla

Konular

Shared Access Signatures and Token-based Storage Security

Bu konudan daha fazla soru